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This listing of claims replaces all prior versions, and 
listings of claims in the instant application: 

Listing of Claims? 

1. (Currently Amended) A method for executing an 
obfuscated application program, the method comprising: 

receiving an obfuscated application program, said 
obfuscated application program comprising at least one 
instruction opcode value encoded using one of a 
plurality of instruction set opcode value encoding 
schemes ; 

receiving an application program instruction 
corresponding to a current instruction counter value; 

selecting an instruction dispatch table based at 
least on said current instruction counter value; and 

executing said application program instruction 
using said selected instruction dispatch table to 
obtain a reference to an instruction implementation 
method corresponding to anfcfee opcode value of -tke said 
application program instruction. 

2. (Previously Presented) The method of claim 1, 
further comprising: 

determining whether there is another application 
program instruction to be executed; 

advancing said current instruction counter if 
there is another application program instruction to be 
executed; and 

repeating said receiving said application program 
instruction, said selecting and said executing after 
said advancing. 

3. (Previously Presented) The method of claim 1 
wherein said selecting further comprises: 

performing modulo -n arithmetic operation on said 
current instruction counter value, where n is the 
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number of dispatch tables, each of said dispatch tables 
associated with, a unique number between 0 and n-l ; and 

selecting the instruction dispatch table 
associated, with the result of said rnodulo-n. arithmetic 
operation. 

4. (Previously Presented) The method of claim 1 
wherein the number of instruction dispatch tables is based 
at least on a number of instructions in a method of said 
obfuscated application program. 

5. (Original) The method of claim 4 wherein said 
number of instruction dispatch tables is greater than or 
equal to said number of instructions. 

6'. (Original) The method of claim 5 wherein said 
number of instruction dispatch tables equals said number of 
instructions. 

7. (Previously Presented) The method of claim 1 
wherein the number of instruction dispatch tables is based 
at least on an amount of available memory. 

8. (Previously Presented) A method for application 
program obfuscation, the method comprising: 

reading an application program comprising code/ 
determining a plurality of dispatch tables 
associated with said application program; 

transforming said application program into 
application program code configured to utilize said 
plurality of dispatch tables during application program 
execution to determine the location of instruction 
implementation methods to be executed based at least on 
using a current instruction counter value to select a 
dispatch . table in said plurality of dispatch tables for 
use with an application program instruction 
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corresponding to said current instruction counter 
value; and 

sending said application program code. 

9. (Previously Presented) The method of claim 8 
wherein said determining further comprises determining the 
encoding of said plurality of dispatch tables based at least 
on a relative frequency of instructions in said application 
program code . 

10. (Original) The method of claim 8 wherein said 
determining further comprises filtering said plurality of 
dispatch tables to . flatten the frequency distribution of 
instructions over said transformed application program code, 

11. (Original) The method of claim 8 wherein 
said method further comprises, after said 

transforming, applying a cryptographic process to said 
application program code together with a cryptographic 
key to create an encrypted obfuscated application 
program; and 

said sending comprises sending said encrypted 
obfuscated application program. 

12 . (Currently Amended) A program storage device 
readable by a machine, embodying a program of instructions 
executable by the machine to perform a method for executing 
an obfuscated application program, the method comprising: 

receiving an obfuscated application program, said 
obfuscated application program comprising at least one 
instruction opcode value encoded using one of a 
plurality of instruction set opcode value encoding 
schemes ; 
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receiving an application program instruction 




corresponding to a current instruction counter value ; 

selecting an instruction dispatch table based at 
least on said current instruction counter value; and 
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executing said application program instruction 
using said selected instruction dispatch table to 
obtain a reference to an instruction implementation 
method corresponding to anfefee opcode value of fehe said 
application program instruction. 

13 . (Previously Presented) The program storage device 
of claim 12, said method further comprising: 

determining whether there is another application 
program instruction to be executed; 

advancing said current instruction counter if 
there is another application program instruction to be 
executed; and 

repeating said receiving said application program 
instruction, said selecting and said executing after 
said advancing. 

14 . (Previously Presented) The program storage device 
of claim 12 wherein said selecting further comprises: 

performing modulo-n arithmetic operation on said 
current instruction counter value, where n is the 
number of dispatch tables, each of said dispatch tableB 
associated with a unique number between 0 and n-1; and 

selecting the instruction dispatch table 
associated with the result of said modulo-n arithmetic 
operation. 
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15. (Previously Presented) The program storage device 
of claim 12 wherein the number of instruction dispatch 
tables is based at least on a number of instructions in a 
method of said obfuscated application program. 

16. (Original) The program storage device of claim 15 
wherein said number of instruction dispatch tables is 
greater than or equal 1 to said number of instructions. 
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17. (Original) The program storage device of claim 16 
wherein said number of instruction dispatch tables equals 
said number of instructions. 

18 - (Previously Presented) The program storage device 
of claim 12 wherein the number of instruction dispatch 
tables is based at least on an amount of available memory. 



19. (Previously Presented) A program storage device 
readable by a machine, embodying a program of instructions 
executable by the machine to perform a method for 
application program obfuscation, the method comprising: 

reading an application program comprising code; 

determining a plurality of dispatch tables 
associated with said application program; 

transforming said application program into 
application program code configured to utilize said 
plurality of dispatch tables during application program 
execution to determine the location. of instruction 
implementation methods to be executed based at least on 
using a current instruction counter value to select a 
dispatch table in said plurality of dispatch tables for 
use with an application program instruction 
corresponding to said current instruction counter 
value; and 

sending said application program code. 

20. (Previously Presented) The program storage device 
of claim 19 wherein said determining further comprises 
determining the encoding of said plurality of dispatch 
tables based at least on a relative frequency of 
instructions in said application program code. 
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21. (Original) The program storage device of claim 19 
wherein said determining further comprises filtering said 
plurality of dispatch tables to flatten the frequency 



Page 7 of 2 7 



PAGE 10/30 * RCVD AT 8/29/2007 7:01:13 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/20 ■ DNIS:2738300 • CSID:831 655 0888 1 DURATION (mm-ss):08-38 



08/29/07 15:01 FAX 831 655 0888 



GUNNISON MCKAY HODGSON 



©Oil 



GUNNISOP, MCKAY £ 

Omnia, Wo* OfTke Hnia 
1900 CL^Mai Ibd, 3uiJc 33Q 
Mtiwbcrcy, CA 03040 

(u n tfss-osao 



Appl. No- 10/672,103 

Arndti. dated August 29, 2007 

Reply to Office Action of July 2, 2007 



distribution of instructions over said transformed 
application program code. 

22. (Original) The program storage device of claim 19 
wherein 

said method further comprises, after said 
transforming, applying a cryptographic process to said 
application program code together with a cryptographic 
key to create an encrypted obfuscated application 
program; and 

said sending comprises sending said encrypted 
obfuscated application program. 

23. (Currently Amended) An apparatus for executing an 
obfuscated application program, the apparatus comprising: 

means for receiving an obfuscated application 
program, said obfuscated application program comprising 
at least one instruction opcode value encoded using one 
of a plurality of instruction set opcode value encoding 
schemes; 

means for receiving an application program 
instruction corresponding to a current instruction 
counter value ; 

means for selecting an instruction dispatch table 
based at least on said current instruction counter 
value; and 

means for executing said application program 
instruction using said selected instruction dispatch 
table to obtain a reference to an instruction 
implementation method corresponding to ant-foe opcode 
value of -fehe said application program instruction. 

24. (Previously Presented) The apparatus of claim 23, 
further comprising: 

means for determining whether there is another 
application program instruction to be executed; 
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means for advancing said current instruction 
counter if there is another application program 
instruction to be executed; and 

means for repeating said receiving said 
application program instruction, said selecting and 
said executing after said advancing. 

25. (Previously Presented) The apparatus of claim 23 
wherein said means for selecting further comprises; 

means for performing modulo-n arithmetic operation 
on said current instruction counter value, where n is 
the number of dispatch tables, each of said dispatch 
tables associated with a unique number between 0 and n- 
1 / and 

means for selecting the instruction dispatch table 
associated with the result of said modulo-n arithmetic 
operation. 

26- (Previously Presented) The apparatus of claim 23 
wherein the number of instruction dispatch tables is based 
at least on a number of instructions in a method of said 
obfuscated application program. 

27. (Original) The apparatus of claim 26 wherein said 
number of instruction dispatch tables is greater than or 
equal to said number of instructions . 

28. (Original) The apparatus of claim 27 wherein said 
number of instruction dispatch tables equals said number of 
instructions * 

29. (Previously Presented) The apparatus of claim 23 
wherein the number of instruction dispatch tables is based 
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at least on an amount of available memory. 



30. 



(Previously Presented) An apparatus for 
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a processor; and 
a memory, coupled to said processor, having stored 
therein computer readable instructions wherein 
executing said computer readable instructions on said 
processor provides; 

means for reading an application program 
c omp r i s ing code ; 

means for determining a plurality of dispatch 
tables associated with said application program; 

means for transforming said application 
program into application program code configured 
to utilize said plurality of dispatch tables 
during application program execution to determine 
the location of instruction implementation methods 
to be executed based at least on using a current 
instruction counter value to select a dispatch 
table in said plurality of dispatch tables for use 
with an application program instruction 
corresponding to said current instruction counter 
value; and 

means for sending said application program 

code - 

31. (Previously Presented) The apparatus of claim 3 0 
wherein said means for determining further comprises means 
for determining the encoding of said plurality of dispatch 
tables based at least on a relative frequency of 
instructions in said application program code. 

32. (Original) The apparatus of claim 30 wherein said 
means for determining further comprises filtering said 
plurality of dispatch tables to flatten the frequency 
distribution of instructions over said transformed 
application program code. 

33. (Original) The apparatus of claim 30 wherein 
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said apparatus further comprises, means for 
applying a cryptographic process to said application 
I program code together with a cryptographic key to 

create an encrypted obfuscated application program in 
response to said transforming; and 

said means for sending comprises means for sending 
said encrypted obfuscated application program. 

34. (Currently Amended) An apparatus for executing an 
obfuscated application program, the apparatus comprising a 
user device configured to: 

receive an obfuscated application program, said 
obfuscated application program comprising at least one 
instruction opcode value encoded using one of a 
plurality of instruction set opcode value encoding 
schemes ; 

receive an application program instruction 
corresponding to a current instruction counter value ; 

select an instruction dispatch table based at 
least on said current instruction counter value; and 

execute said application program instruction using 
said selected instruction dispatch table to obtain a 
reference to an instruction implementation method 
corresponding to an^fee opcode value of ^fee said 
application program instruction. 

35. (Previously Presented) The apparatus of claim 34 , 
said user device further configured to: 

determine whether there is another application 
program instruction to be executed; 

advance said current instruction counter if there 
is another application program instruction to be 
| executed; and 

c 5SSSE£S£ ,ft I repeat said receiving said application program 

Ganlaj Weil 0 fTua: ?Ut3 , . , 

m £tZ^*i£ m instruction, said selecting and said executing after 

mowm said advancing. 
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36. (Previously Presented) The apparatus of claim 34 
wherein said user device is further configured to: 

perform modulo-n arithmetic operation on said 
current instruction counter value, where n is the 
number of dispatch tableB, each of said dispatch tables 
associated with a unique number between 0 and n-1; and 

select the instruction dispatch table associated 
with the result of said modulo-n arithmetic operation. 

37. (Previously Presented) The apparatus of claim 34 
wherein the number of instruction dispatch tables is based 
at least on a number of instructions in a method of said 
obfuscated application program. 

38. (Original) The apparatus of claim 37 wherein said 
number of instruction dispatch tables is greater than or 
equal to said number of instructions. 

39. (Original) The apparatus of claim 38 wherein said 
number of instruction dispatch tables equals said number of 
instructions - 

40. (Previously Presented) The apparatus of claim 34 
wherein the number of instruction dispatch tables is based 
at least on an amount of available memory. 

41. (Previously Presented) An apparatus for 
application program obfuscation, the apparatus comprising an 
application program provider including a processor, and 
memory, coupled to said processor, having stored therein 
computer readable instructions wherein upon executing said 
computer readable instructions on said processor said 
application program provider is configured to: 

read an application program comprising code; 
determine a plurality of dispatch tables 
associated with said application program; 
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transform said application program into 
application program code configured to utilize said 
plurality of dispatch tables during application program 
execution to determine the location of instruction 
implementation methods to be executed based at least on 
use of a current instruction counter value to select a 
dispatch table in said plurality of dispatch tables for 
use with an application program instruction 
corresponding to said current instruction counter 
value; and 



42. (Previously Presented) The apparatus of claim 41 
wherein said application program provider is further 
configured to determine the encoding of said plurality of 
dispatch tables based at least on a relative frequency of 



43. (Original) The apparatus of claim 41 wherein said 
application program provider is further configured to filter 
said plurality of dispatch tables to flatten the frequency 
distribution of instructions over said transformed 
application program code. 

44. (Original) The apparatus of claim 41 wherein 
said application program provider is further 

configured to apply a cryptographic process to said 
application program code together with a cryptographic 
key to create an encrypted obfuscated application 
program ; and 

said application program provider is further 
configured to send said encrypted obfuscated 
application program. 



send said application program code. 



instructions in said application program code. 
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comprising : 

a processor; and 



45. 



(Previously Presented) A data processing system 



/ 
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memory, coupled to said processor, for storing data for 
access by an application program being executed on said data 
processing system, said memory comprising: 

a data structure stored in said memory, said data 
structure including information used by said 
application program to execute an obfuscated 
application program on said data processing system, 
said data structure comprising application program code 
configured to utilize a plurality of dispatch tables 
during execution of said obfuscated application program 
to determine a location of instruction implementation 
methods to be executed based at least on using a 
current instruction counter value to select a dispatch 
table in said plurality of dispatch tables for use with 
an application program instruction corresponding to 
said current instruction counter value. 
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46. (Currently Amended) The _da ta processing system 
memory of claim 45 wherein said data structure further 
comprises a cryptographic key and protected data, said 
protected data encrypted using said cryptographic key. 

47. (Currently Amended) The data processing system 
memory of claim 45 wherein said data structure further 
comprises an obfuscation descriptor that indicates an 
obfuscation method used to create said obfuscated 
application program. 

48. (Previously Presented) A data processing system 
comprising : 

a processor; and 

memory, coupled to said processor, for storing data for 
access by an application program being executed on said data 
processing system, said memory comprising: 

a data structure stored in said memory, said data 
structure including information used by said 
application program to execute an obfuscated 
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application program, said data structure comprising a 
plurality of dispatch tables used during execution of 
said obfuscated application program to determine a 
location of instruction implementation methods to be 
executed based at least on using a current instruction 
counter value to select a dispatch table in said 
plurality of dispatch tables for use with an 
application program instruction corresponding to said 
current instruction counter value. 
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